Election officials across the country have worked hard to prioritize security ahead of November's midterms, but some strategies could have the unintended effect of sometimes making voting harder. CREDIT: JUSTIN SULLIVAN

To Deter Foreign Hackers, Some States May Also Be Deterring Voters

By NPR News October 12, 2018

BY MILES PARKS

A number of states are blocking web traffic from foreign countries to their voter registration websites, making the process harder for some U.S. citizens who live overseas to vote, despite the practice providing no real security benefits.

On its face, the “geo-targeting” of foreign countries may seem like a solid plan: election officials around the country are concerned about foreign interference after Russia’s efforts leading up to the 2016 election, so blocking traffic to election websites from outside the United States might seem like an obvious defense starting point.

But cybersecurity experts and voting rights advocates say it’s an ineffective solution that any hacker could easily sidestep using a virtual private network, or VPN, a commonly-used and easily-available service. Such networks allow for a computer user to use the Internet and appear in a different location than they actually are.

“It’s totally ridiculous,” said Joseph Lorenzo Hall, the chief technologist for the Center For Democracy & Technology. “Any concerted attacker would use a VPN, they’re really cheap. If anything, this is just marketing.”

Media reports began circulating over the past two months that states were blocking international traffic to their sites. The Philadelphia Inquirer specifically indicated in a report last week that at least five states were blocking international traffic to their election sites.

NPR attempted to access the online registration sites of each state that allows online registration, using an international IP address based in Brazil. At least nine states — Kansas, Vermont, Oregon, Massachusetts, Tennessee, Kentucky, New Mexico, Georgia, and Pennsylvania — did not allow access from the international IP address, but allowed access from a U.S. IP address.

Vermont, New Mexico, Massachusetts, and Oregon confirmed to NPR that they did block all or some international traffic to the voter registration portion of their websites, and Georgia and Pennsylvania confirmed the same to other outlets. As of Thursday, the other states had not yet responded to requests for comment.

“Ensuring the cyber security of our online systems requires a balancing act between voter access and defending our election systems from bad actors,” said Vermont Secretary of State Jim Condos.

Although the “geo-blocking” strategy may not actually have any effect on a hacker with easy access to a VPN, it could have an effect on U.S. citizens living outside the country who are eligible to vote. The Federal Voting Assistance Program estimates there are 3 million such citizens, which is roughly the same number of eligible voters as a mid-sized state.

Turnout for overseas voters is notoriously low. In 2016, less than 7 percent of eligible non-military voters residing outside of the country returned ballots, according to FVAP.

“That’s probably a kindergarten level of security, thinking you can target parts of the world geographically,” said Susan Dzieduszycka-Suinat, the CEO of the nonprofit Overseas Vote. “It’s so ineffective I don’t even know how to start.”

Federal law requires states to allow overseas voters to request an absentee ballot online. And Dzieduszycka-Suinat said the Internet has “completely transformed” the voting possibilities for overseas voters, as it’s the “most efficient way” for non-residents to get information and request a ballot.

In every case where overseas voters may be blocked from websites, there are, however, still ways they can get their ballots. But it makes the process more complicated when voters are unable to register the same way they would be able to in the U.S.

Oregon Election Director Stephen Trout acknowledged the shortcomings of geo-blocking, which he said has been going on in his state since at least 2009.

On a part of the state’s website that isn’t blocked to overseas visitors, voters are told that if they can’t access the elections website, they should call the state or their local election official. Trout said his office received a handful of calls about the issue last week, and that they usually receive three or four dozen each election cycle.

He said his office will continue to re-evaluate security strategies.

“As hackers get more sophisticated, we need to look at other ways,” said Trout. “There’s a lot different than there was five years ago, and it will be a lot different in another five years.”

Condos, the Vermont secretary of state, said his office has only been contacted by a few overseas voters in connection with the decision. He added that if it becomes a “significant barrier” for overseas voters, his office may also reassess the geo-blocking.

As for now, overseas Vermont voters that need to register to vote can send a voter registration form to their municipal clerk by mail or email, or they can register through the federal government.

In New Mexico and Pennsylvania, even the area where registered voters can request an absentee ballot is blocked for visitors from overseas IP addresses.

“Voters can give us a call, we can walk you through it,” said Alex Curtas, the communications director for the New Mexico Secretary of State.

But it just adds another, sometimes confusing, step for a subset of voters who already turn out at a low rate, said Hall, of the Center For Democracy & Technology.

“Every click you put in front of people – you have a precipitous drop in continuing the process,” Hall said. “They have a ton of barriers already, and this is another one of them.”

NPR Brazil Correspondent Phillip Reeves contributed reporting to this story.